ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29

General

Target

ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe
Size

916KB
MD5

cd80bb33720d72ac3fd763f29b4738a1
SHA1

7e14f13f856d671bb6ba32b2a52389c04b634b3e
SHA256

ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29
SHA512

5cccfbf2bf446a983e3c9141bd806d7a7d3603316ab24362227fc3ddcc420b41cf6df03dc88e516c063430b315715599d1b069a5718adfdbdf4f921c498dd2ea
SSDEEP

24576:NJnav4dbkHXlQTlACio/uyy5150XxiRE/U0:bav48X+TlAfUoteF/j

Score

8^/10

spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

setup.exe

pid process

1228 setup.exe

pid	process
1228	setup.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\setup.exe	upx
C:\Users\Admin\AppData\Local\Temp\setup.exe	upx
C:\Users\Admin\AppData\Local\Temp\setup.exe	upx
behavioral1/memory/1204-60-0x0000000000350000-0x0000000000606000-memory.dmp	upx
behavioral1/memory/1228-62-0x0000000000270000-0x0000000000526000-memory.dmp	upx
behavioral1/memory/1228-63-0x0000000000270000-0x0000000000526000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe

pid process

1204 ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1592 1228 WerFault.exe setup.exe

pid	pid_target	process	target process
1592	1228	WerFault.exe	setup.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exesetup.exe

pid	process
1204	ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe
1204	ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe
1228	setup.exe
1228	setup.exe
1228	setup.exe
1228	setup.exe
1228	setup.exe
1228	setup.exe
1228	setup.exe
1228	setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe

description	pid	process	target process
PID 1204 wrote to memory of 1228	1204	ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe	setup.exe
PID 1204 wrote to memory of 1228	1204	ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe	setup.exe
PID 1204 wrote to memory of 1228	1204	ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe	setup.exe
PID 1204 wrote to memory of 1228	1204	ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe	setup.exe
PID 1204 wrote to memory of 1228	1204	ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe	setup.exe
PID 1204 wrote to memory of 1228	1204	ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe	setup.exe
PID 1204 wrote to memory of 1228	1204	ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe	setup.exe

C:\Users\Admin\AppData\Local\Temp\ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe
"C:\Users\Admin\AppData\Local\Temp\ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Admin\AppData\Local\Temp\setup.exe
C:\Users\Admin\AppData\Local\Temp\setup.exe relaunch
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 348
3⤵
- Program crash
PID:1592

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
916KB

MD5
cd80bb33720d72ac3fd763f29b4738a1

SHA1
7e14f13f856d671bb6ba32b2a52389c04b634b3e

SHA256
ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29

SHA512
5cccfbf2bf446a983e3c9141bd806d7a7d3603316ab24362227fc3ddcc420b41cf6df03dc88e516c063430b315715599d1b069a5718adfdbdf4f921c498dd2ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
916KB

MD5
cd80bb33720d72ac3fd763f29b4738a1

SHA1
7e14f13f856d671bb6ba32b2a52389c04b634b3e

SHA256
ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29

SHA512
5cccfbf2bf446a983e3c9141bd806d7a7d3603316ab24362227fc3ddcc420b41cf6df03dc88e516c063430b315715599d1b069a5718adfdbdf4f921c498dd2ea

Download Submit
\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
916KB

MD5
cd80bb33720d72ac3fd763f29b4738a1

SHA1
7e14f13f856d671bb6ba32b2a52389c04b634b3e

SHA256
ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29

SHA512
5cccfbf2bf446a983e3c9141bd806d7a7d3603316ab24362227fc3ddcc420b41cf6df03dc88e516c063430b315715599d1b069a5718adfdbdf4f921c498dd2ea

Download Submit
memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1204-60-0x0000000000350000-0x0000000000606000-memory.dmp

Filesize
2.7MB

Download
memory/1204-61-0x00000000027A0000-0x0000000002A56000-memory.dmp

Filesize
2.7MB

Download
memory/1228-56-0x0000000000000000-mapping.dmp

Download
memory/1228-62-0x0000000000270000-0x0000000000526000-memory.dmp

Filesize
2.7MB

Download
memory/1228-63-0x0000000000270000-0x0000000000526000-memory.dmp

Filesize
2.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads